CVE-2023-22637

CRITICAL 9.0CVE-2023-22637 · Published 03/05/2023 · updated 17/06/2026

In short

CVE-2023-22637 is a CRITICAL (CVSS 9.0) vulnerability affecting fortinac (fortinet), fortinac-f (fortinet).
Chance of exploitation in the next 30 days (EPSS): 0.61%, higher than 49.2% of all vulnerabilities.
Fix: update to 9.4.3 or later.

Package	Affected versions	Patched versions
fortinac fortinet	`≥ 8.7.0, < 9.4.3`	`9.4.3`
fortinac-f fortinet	`= 7.2.0`	No fix yet

Description

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in License Management would permit an authenticated attacker to trigger remote code execution via crafted licenses.

References

fortiguard.com/psirt/FG-IR-23-013 · Vendor Advisory

More vulnerabilities in fortinac

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

fortinac

fortinet

≥ 8.7.0, < 9.4.3

9.4.3

fortinac-f

fortinet

= 7.2.0

No fix yet

Description

More vulnerabilities in fortinac

See all →